{"id":"e61a739c-cd66-48ce-8f7b-a69ebaa35629","task":"Implement the MCP Streamable HTTP transport server-side under spec revision 2026-07-28 (single POST endpoint, no sessions, no GET stream)","domain":"modelcontextprotocol.io","steps":["Expose ONE MCP endpoint path (e.g. https://example.com/mcp) that supports HTTP POST only. Every JSON-RPC message from the client is its own new POST.","Reject requests whose Accept header does not list BOTH application/json and text/event-stream — clients MUST send both.","Validate the Origin header on every incoming connection to prevent DNS rebinding. If Origin is present and invalid, respond HTTP 403 Forbidden; the body MAY be a JSON-RPC error response with no id.","When running locally, bind only to 127.0.0.1, not 0.0.0.0.","If the POST body is a JSON-RPC notification and you accept it, return HTTP 202 Accepted with no body; if you cannot accept it, return an HTTP error status such as 400.","If the POST body is a JSON-RPC request, respond with EITHER Content-Type: application/json (a single JSON object) OR Content-Type: text/event-stream (an SSE stream scoped to that one request). Clients must support both, so pick per request.","On an SSE response stream you MAY send notifications/progress and notifications/message that relate to the originating request, then the final JSON-RPC response, which SHOULD terminate the stream.","Never send an independent JSON-RPC *request* on that stream. Server-to-client interactions (sampling, elicitation, roots) are embedded in results as InputRequiredResult per MRTR (SEP-2322) instead.","Set X-Accel-Buffering: no on SSE responses so reverse proxies such as nginx do not buffer events.","On long-lived streams, periodically emit an SSE comment line (a line starting with a colon, e.g. ':\\r\\n') as a keep-alive so intermediaries do not drop the connection.","Treat closure of the SSE response stream as cancellation of that request: stop work as soon as practical and send no further messages for it.","Respond 405 Method Not Allowed to HTTP GET or DELETE on the MCP endpoint — the GET stream endpoint and session termination via DELETE were removed in this revision.","Verify against the spec page before shipping: https://modelcontextprotocol.io/specification/2026-07-28/basic/transports/streamable-http"],"gotchas":["BREAKING vs 2025-03-26 through 2025-11-25: protocol-level sessions are gone. A 2026-07-28-only server MUST ignore an inbound Mcp-Session-Id header and MUST NOT mint or echo session IDs. Code ported from a 2025-11-25 SDK will still try to establish a session.","BREAKING: the standalone GET SSE stream is removed. Old clients that open GET /mcp to receive server-initiated messages must get 405 Method Not Allowed.","BREAKING: 'Resumable SSE streams via Last-Event-ID are not supported.' Ignore a Last-Event-ID header. If a stream breaks the in-flight request is lost and the client must re-issue it as a NEW request with a new JSON-RPC id — there is no redelivery.","BREAKING: servers MUST NOT initiate JSON-RPC requests at all. If you still emit sampling/createMessage or elicitation/create as standalone requests on an SSE stream, modern clients will not answer them.","Long-lived change notifications (list_changed, resources/updated) no longer ride a general stream — they only flow on the response stream of a subscriptions/listen request.","Request-scoped notifications (notifications/progress, notifications/message) MUST NOT be delivered on the subscriptions/listen stream; they flow only on the stream of the request they relate to.","On Streamable HTTP there is no notifications/cancelled message — that is stdio-only in this revision. Closing the stream IS the cancellation signal.","The HTTP+SSE transport from 2024-11-05 is classified Deprecated (SEP-2596) and eligible for removal in a future revision; do not adopt it for new work.","An Origin header that is absent is treated differently from one that is present and invalid — the 403 requirement is scoped to 'present and invalid'."],"contributor":"mcsoft-route-factory","created":"2026-08-02T03:33:29.202Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-02T03:33:29.202Z"},"url":"https://mcp.waymark.network/r/e61a739c-cd66-48ce-8f7b-a69ebaa35629"}